Par­ents’ anger as coun­cil sends chil­dren’s de­tails to other fam­i­lies

A fam­ily has called on Corn­wall Coun­cil to im­prove its han­dling of per­sonal in­for­ma­tion af­ter dis­cov­er­ing that de­tails about their chil­dren had been sent to strangers.

The data breach was dis­cov­ered when the fam­ily, who have asked not to be iden­ti­fied, opened up an en­ve­lope sent to them re­gard­ing their chil­dren’s school trans­port.

In­side the cou­ple found that not only did they have de­tails about their own ap­pli­ca­tion, but they also found in­for­ma­tion about other chil­dren ap­ply­ing for trans­port.

They knew one of the other fam­i­lies and con­tacted them to see if it was an anom­aly, but were sur­prised to find they had also been sent per­sonal in­for­ma­tion about some­one else’s chil­dren. The fam­ily im­me­di­ately con­tacted the coun­cil to let it know they had been sent the in­for­ma­tion in er­ror.

They claim the per­son who called them back ap­peared “pan­icked” about the data breach, and im­me­di­ately apol­o­gised for the er­ror.

The coun­cil con­firmed to the fam­ily that their chil­dren’s in­for­ma­tion had also been sent to some­one else.

The dad said: “I scanned the in­for­ma­tion about some­one else that we had re­ceived and emailed it to the coun­cil. They ac­knowl­edged re­ceipt of it, but I was amazed that they didn’t ask me to delete the email and de­stroy the pa­per doc­u­ment.

“I think that shows how they han­dle peo­ple’s in­for­ma­tion. They need to be more care­ful. We don’t know who has our chil­dren’s in­for­ma­tion.”

The cou­ple said they ap­pre­ci­ated that there was no sen­si­tive in­for­ma­tion in the pa­per­work, but said they were still con­cerned that per­sonal in­for­ma­tion – in­clud­ing their chil­dren’s names, dates of birth, ad­dress and school – had been sent out to strangers.

The mum said: “We don’t know who has got our in­form- ation and in the hor­ri­ble world that we live in that could have gone to any­one.”

The dad added: “It is hu­man er­ror but they are sup­posed to be an or­gan­i­sa­tion that you can trust with your de­tails.

“They have said that there will be an in­ter­nal in­ves­ti­ga­tion but what will hap­pen af­ter that?

“I’m just con­cerned that while they will say that lessons will be learned I want more of a guar­an­tee that they will im­prove their sys­tems.”

In a state­ment, Corn­wall Coun­cil said: “Last month, un­der the school trans­port ap­peal process, in­for­ma­tion was is­sued in­cor­rectly to five par­ents. As soon as the coun­cil be­came aware of the er­ror the par­ents in­volved were con­tacted, in­for­ma­tion was re­trieved safely and an apol­ogy was made im­me­di­ately.

“The coun­cil pro­cesses large vol­umes of per­sonal data on a daily ba­sis and takes re­spon­si­bil­ity to pro­tect per­sonal data very se­ri­ously. As a re­sult of this er­ror the pro­ce­dures around send­ing out in­for­ma­tion on ap­peals were im­me­di­ately re­viewed.”

The cou­ple spoke out about the data breach af­ter read­ing ear­lier re­ports of a breach where an email was sent out to 155 par­ents of dis­abled chil­dren with their email ad­dresses passed to ev­ery re­cip­i­ent.